Speaker 1: Welcome to the deep dive. We cut through all that
Speaker 1: information noise to bring you the insights you really need. Today,
Speaker 1: we're tackling a topic that, let's be honest, often feels
Speaker 1: like this huge complicated puzzle, cybersecurity for businesses. It can
Speaker 1: seem overwhelming, right, constant threats, it's always changing, super complex.
Speaker 1: But what if there's a simpler way to look at it. Okay,
Speaker 1: let's unpack this. We're not just diving into the tech
Speaker 1: side of things today. We're looking at enterprise cybersecurity from
Speaker 1: well a business perspective, how it all fits together. Our
Speaker 1: guide for this deep dive is actually a quick start formwork.
Speaker 1: It's designed to give businesses something practical, something they can
Speaker 1: actually implement for security ops. So our mission for you,
Speaker 1: our listener, is to cut through that noise. We want
Speaker 1: to give you the key takeaways on how businesses can
Speaker 1: genuinely protect themselves, maybe even streamline things, boost the bottom line,
Speaker 1: all through a smart security strategy. And you don't need
Speaker 1: to be a hardcore cyber expert to get it.
Speaker 2: Yeah, and what's fascinating here is just how often cyber
Speaker 2: professionals feel like they're out there alone. You know, they're
Speaker 2: the protectors, but they're battling internal politics, budget cuts. It's
Speaker 2: tough and the core issue this guide points out a
Speaker 2: lot of the existing security frameworks. They're good, but very theoretical.
Speaker 2: They often lack that practical how to guidance. So you
Speaker 2: see businesses doing things in totally different ways and sometimes
Speaker 2: well it's just not enough. That's really where ZORMA comes
Speaker 2: in the enterprise security Operations risk management architecture. It's designed
Speaker 2: specifically to bridge that theory practice gap. It gives you
Speaker 2: a uniform, adaptable system that really focuses on the practical implementation,
Speaker 2: you know, for businesses of all shapes and sizes.
Speaker 1: That business first angle and ISZOMA really does sound like
Speaker 1: a potential game changer. But I'm wondering how does it
Speaker 1: fit in with everything else You've got NIST ISO twenty
Speaker 1: seven zero one, all those big certifications. Does thesearma replace them?
Speaker 2: No, not at all. It's designed as a practical layer
Speaker 2: on top. Think of it like this NIST or ISO
Speaker 2: might be the architectural blueprints for your house is more
Speaker 2: like the detailed construction manual that tells you how to
Speaker 2: actually build it step by step. Its main purpose is
Speaker 2: really empowering those cyberfolks to talk the language of management,
Speaker 2: not just tex specs, but risk versus return dollars and cents. Basically,
Speaker 2: that's how you get past that talking to a brick
Speaker 2: wall feeling sometimes and at its core, ESORMA uses these
Speaker 2: eight practical domains. People often picture it like a star,
Speaker 2: and right in the middle, the very center is scope.
Speaker 1: Okay, scope at the center. If we connect this to
Speaker 1: the bigger picture, that sounds foundational. So what's the main
Speaker 1: idea there? Why is getting this scope right so so important?
Speaker 2: Well, scoping is all about identification, but it's continuous, it's
Speaker 2: not a one off, and it's vital because frankly, it
Speaker 2: saves time and money down the line. It helps break
Speaker 2: down what feels like this massive, overwhelming job into manageable chunks.
Speaker 2: It starts simply what do you actually need to protect?
Speaker 2: And nine times out of ten, that starts with your data.
Speaker 2: So two key steps here. First, you categorize it. Is
Speaker 2: it personal data, is it sensitive company secrets or just
Speaker 2: general internal stuff. Then you classify it based on how
Speaker 2: critical it is strictly confidential, confidential, internal, may be restricted
Speaker 2: or even public. That classication tells you how much effort
Speaker 2: you need to put into protecting it makes sense.
Speaker 1: You wouldn't guard a public for sure, the same way
Speaker 1: you guard customer credit card number exactly.
Speaker 2: And the guides suggest some really practical tools for this,
Speaker 2: like an information asset register. It's essentially a detailed list
Speaker 2: what's the data, who owns it, what's it worth, where
Speaker 2: is how's it classified? All in one place. Then there's
Speaker 2: a geomapping tool super important. Now with cloud storage, right,
Speaker 2: data can be anywhere in the world.
Speaker 1: Yeah, definitely.
Speaker 2: An information flow map helps you see how data actually
Speaker 2: moves around your systems, where does it go. You've also
Speaker 2: got things like a corporate role calculator helps figure out
Speaker 2: if you're a data controller or a processor under laws
Speaker 2: like GDPR, and even a simple fishbone diagram can be
Speaker 2: great for digging into the root causes of potential risks.
Speaker 1: A fishbone diagram interesting.
Speaker 2: Yeah, and the source tells this great little story about
Speaker 2: a haunted telecoms room in a modern government building, classic
Speaker 2: legacy system, totally forgotten, full of risks nobody dealt with
Speaker 2: because it was never properly scoped, just sitting there.
Speaker 1: Wow, Okay, that really paints a picture.
Speaker 2: It does, and it shows scoping isn't just for the techies.
Speaker 2: It's fundamental governance, especially vital. If there's an emergency.
Speaker 1: That haunted room story is brilliant. It makes you think
Speaker 1: what else is lurking out there, doesn't it? So once
Speaker 1: you've done all that scoping mapped everything out, it can
Speaker 1: still feel like a huge amount to deal with. So
Speaker 1: what's the next step? Anysorma, how do you know, cut
Speaker 1: through it all and figure out what to focus on first?
Speaker 2: That leads us straight into Domain two priority perfect transition.
Speaker 2: I mean, think about it. Businesses face thousands of potential
Speaker 2: threats every day. You absolutely have to prioritize. Otherwise you
Speaker 2: spread your resources too thin, waste effort on things that
Speaker 2: aren't the biggest risks. It's about focusing on the essentials.
Speaker 1: Right focus is key. How does the framework suggest measuring
Speaker 1: risk to help with that prioritizing?
Speaker 2: It talks about two main ways. First is quantitative. That's
Speaker 2: where you put a number on it, usually a currency
Speaker 2: value like dollars or euros. How much could this risk
Speaker 2: cost us? It's precise, good for comparing things, but it
Speaker 2: can take more time and effort. The other way is qualitative.
Speaker 2: This is more based on well human knowledge and intuition
Speaker 2: your rank risks like small, medium, large, or high medium low.
Speaker 2: It's faster, often less expensive to start with.
Speaker 1: Okay, numbers versus judgment calls essentially sort.
Speaker 2: Of yeah, And when we talk risk, we have to
Speaker 2: mention human risk factors. There's this common idea that people
Speaker 2: are the weakest link in security, but honestly, more often
Speaker 2: it's the processes that let people down, or maybe they
Speaker 2: just don't understand why a security control is there, so
Speaker 2: they find a workaround for innocent reasons, just trying to
Speaker 2: get their job done.
Speaker 1: That's a really important distinction. It's not always malicious intent.
Speaker 1: Sometimes it's just friction in the system or maybe confusion.
Speaker 1: And here's where it gets yearly interesting. The framework suggests
Speaker 1: ways to tackle that human risk without just throwing expensive
Speaker 1: tech at it.
Speaker 2: Right, absolutely, and they're often surprisingly simple. Process changes. Think
Speaker 2: about least privileged access. Just give people the minimum access
Speaker 2: they need to do their specific job. Nothing more like
Speaker 2: giving someone a key card that only opens their office,
Speaker 2: not the whole building.
Speaker 1: Simple but effective, definitely.
Speaker 2: Then there's job rotation or cross training. This does two things,
Speaker 2: builds backup so you're not relying on one person, and
Speaker 2: it helps prevent fraud or collusion because different people see
Speaker 2: the process. Job segregation is similar. You separate key tasks,
Speaker 2: like the person entering invoices shouldn't be the person approving payments.
Speaker 2: Basic check and balance makes sense. Someone that's often missed,
Speaker 2: but absolutely critical employment termination procedures. A former employee who's
Speaker 2: unhappy and still have access or knows all your secrets.
Speaker 2: That's a massive risk. The GUIDO really stresses immediate access
Speaker 2: removal the second someone leaves.
Speaker 1: Yeah, you hear horror stories about that. So it's smart processes,
Speaker 1: clear policies, not just tech. But I also saw the
Speaker 1: guide mentioned putting actual numbers on risk. How does that
Speaker 1: calculation work? Why is it so useful?
Speaker 2: Right? This is where the quantitative part comes back in,
Speaker 2: and it's powerful for talking to management. It translates threats
Speaker 2: into potential financial impact. It breaks it down. You've got
Speaker 2: the asset value AV, what's the thing you're protecting actually worth?
Speaker 2: Then the exposure factor EF. What percentage of that value
Speaker 2: would you lose if the bad thing happens? See fifty percent.
Speaker 2: Multiply AV by EF and you get your single loss
Speaker 2: expectancy sl E cost of one incident.
Speaker 1: Okay, AV times EF equals sl E.
Speaker 2: Got it. Then how often might this happen? That's your
Speaker 2: annual rate of occurrence ARO? Maybe it's once a year,
Speaker 2: AR one, maybe once every five years AR point two
Speaker 2: multiplayer sl by the RO and big O annualized loss
Speaker 2: expectancy ALI. That al figure gives management a clear idea. Okay,
Speaker 2: this risk could cost us X amount per year on average.
Speaker 2: It makes investing in a safeguard that costs less than
Speaker 2: the ale a much easier decision.
Speaker 1: Really clarifies the business case exactly, and.
Speaker 2: You manage all this information and risk registers plural is important.
Speaker 2: You might have different ones for different areas or sensitivity levels.
Speaker 2: It gives you that clear, up to date big picture.
Speaker 1: That's a really powerful way to frame security decisions. So, Okay,
Speaker 1: you've scoped things out, you've prioritized using these methods. Now
Speaker 1: you need to pick the right solutions. How does ESORMA
Speaker 1: handle that evaluation?
Speaker 2: This raise is an important question, doesn't it? How do
Speaker 2: you choose controls effectively without just reacting to the first
Speaker 2: problem you see? That's domain three. Evaluate. It's all about
Speaker 2: systematically comparing and selecting the right controls. It's not just
Speaker 2: fixing things, it's balancing governance, risk and compliance.
Speaker 1: Needs, okay, balancing react. What tools help with that?
Speaker 2: A really critical one here is the business impact analysis
Speaker 2: the BIA. Now this isn't just another inventory list. It
Speaker 2: details everything essential for your business to run. Assets, sure,
Speaker 2: but also key people, processes, stock, suppliers, everything. Its main
Speaker 2: goal is to understand timing. How long can a critical
Speaker 2: process be down before it really hurts your clients before
Speaker 2: they notice, and that understanding helps you prioritize recovery efforts
Speaker 2: based on what matters most to your customers, not just
Speaker 2: internal costs or risks.
Speaker 1: So it connects security back to the customer experience precisely.
Speaker 2: And the ESORMA approach is really pragmatic. Here it says, look,
Speaker 2: get a basic BIA done quickly, like in days, not
Speaker 2: months or a year, because, as the guide puts it
Speaker 2: so well, having a plan is always better than having
Speaker 2: no plan. Even an imperfect plan is a start.
Speaker 1: I like that agile approach. Bete's getting bogged down an
Speaker 1: analysis paralysis. You've got your BIA, you understand the timing.
Speaker 1: What else feeds into evaluation?
Speaker 2: Well? The guide recommends using a form driven approach and
Speaker 2: interviews it's an efficient way to gather info and bonus.
Speaker 2: It's workings. You often spot ways to improve processes generally,
Speaker 2: not just for security. Then you need to understand your
Speaker 2: risk appetite. How much risk is the business actually willing
Speaker 2: to accept? Is there a budget limit for losses? Has
Speaker 2: the board metter decisions would have passed? Practice is shown.
Speaker 1: So defining the tolerance level exactly.
Speaker 2: And then there are more timing concepts linked to the BIA.
Speaker 2: Maximum tolerable downtime MTD the absolute point of no return
Speaker 2: for a process. Recovery time objective RTO how quickly do
Speaker 2: you need to get a service back up? This dictates
Speaker 2: whether you need a hot site ready instantly, warm site
Speaker 2: needs some setup, or cold site just infrastructure and recovery
Speaker 2: coint objective RPO How much data can you afford to
Speaker 2: lose an hour's worth a day's worth. That determines backup.
Speaker 1: Frequency MTD rt RPO key metrics very key.
Speaker 2: And finally, evaluation leads you to choose your risk treatment strategy.
Speaker 2: There are four main options. Acceptance, you know the risk,
Speaker 2: You consciously decide to do nothing, maybe it's too costly
Speaker 2: to fix. Avoidance you change hey, you do things to
Speaker 2: eliminate the risk entirely. Mitigation you put in countermeasures controls
Speaker 2: this is the most common one. And transfer you shift
Speaker 2: the risk, usually through insurance or outsourcing.
Speaker 1: Contracts except avoid mitigate transfer.
Speaker 2: Okay, And the upshot of all this evaluation, it's not
Speaker 2: just about better security. You almost always find ways to
Speaker 2: streamline things, cut costs, improve efficiency alongside security benefits.
Speaker 1: That's a great selling point. Okay. So from evaluating, the
Speaker 1: natural next step is actually doing something, putting plans into action.
Speaker 1: That sounds like domain for enable exactly.
Speaker 2: Enable is where the rubber meets the road. You authorize
Speaker 2: the activity, you implement the controls you chose, you test
Speaker 2: them rigorously, and then you reevaluate its decision and action time.
Speaker 1: What's involved in getting started with enablement?
Speaker 2: A key first step is often a gap analysis where
Speaker 2: are we now versus where do we need to be
Speaker 2: based on our evaluation, And crucially, you need buy in.
Speaker 2: You have to consult with stakeholders, your staff, management, maybe
Speaker 2: even key clients to make sure everyone's on board with
Speaker 2: the changes.
Speaker 1: People need to understand the why.
Speaker 2: Absolutely, which is why effective risk communication is so important. Here,
Speaker 2: the guide suggests using a simple risk awareness checklist too,
Speaker 2: just to make sure everyone understands their specific role in
Speaker 2: the security posture. The goal is really to weave security
Speaker 2: into the fabric of the organization right from the start.
Speaker 2: This domain also heavily features the PDCA cycle planed oh,
Speaker 2: check act. It's a classic continuous improvement loop.
Speaker 1: Plan do check act. Can you break that down quickly?
Speaker 2: Sure? Plan design your security program or control, Do implement it,
Speaker 2: execute the plan, check aut of it, measure its effectiveness,
Speaker 2: see if it's working. Act, make improvements based on what
Speaker 2: you learned, then start the cycle.
Speaker 1: Again continuous improvement. How do you measure if it's actually working?
Speaker 1: In the check.
Speaker 2: Phase, you use various metrics, things like key goal indicators
Speaker 2: kgis or we achieving our overall security goals, Critical success
Speaker 2: factors CSS what needs to go right for us to succeed,
Speaker 2: and Key performance indicators KPIs specific measurable metrics that show
Speaker 2: how well controls are performing day to day. These give
Speaker 2: you that visibility those real time alerts if something's off right.
Speaker 1: Metrics are essential.
Speaker 2: Yeah, and resource management is also a big part of ENABLE,
Speaker 2: especially managing security across older legacy systems alongside maybe newer
Speaker 2: cloud setups. It can get complex and you'll be implementing
Speaker 2: different types of controls. Preventative ones to stop bad things happening,
Speaker 2: detective ones to spot them if they do, Corrective ones
Speaker 2: to fix the damage, compensating controls as workarounds if a
Speaker 2: primary control fails, and deterrent controls to discourage attackers.
Speaker 1: Lots of different control types.
Speaker 2: Yep, all guided by those core principles like least privileged
Speaker 2: and segregation of duties we talked about earlier. Of course,
Speaker 2: Enable isn't without its hurdles. You often face common challenges,
Speaker 2: resistance to change in the organization people seeing security is
Speaker 2: just a roadblock, the difficulty of proving value with subjective
Speaker 2: measures sometimes and will sometimes plans just fail. This domain
Speaker 2: helps you anticipate and navigate.
Speaker 1: Those Okay, so Enable gets things running. Then comes to
Speaker 1: main five Harden. This sounds like building stronger defenses. What's
Speaker 1: the focus here?
Speaker 2: Harden is exactly that, actively protecting against attacks. But it's
Speaker 2: more than just tech defenses. It's about building genuine business
Speaker 2: resils millions. The goal is to ensure the business can
Speaker 2: keep operating, keep serving customers, protect its people and income
Speaker 2: even when things go wrong.
Speaker 1: So resilience is the key outcome.
Speaker 2: How do you achieve that pre planning is absolutely essential?
Speaker 2: You use that business impact analysis from domain three as
Speaker 2: your foundation. Understanding your critical processes and recovery needs lets
Speaker 2: you build resilience in from the start. This naturally flows
Speaker 2: into creating solid business continuity BC and Disaster Recovery DR plans.
Speaker 2: And here's something the guide really emphasizes clarity in your
Speaker 2: documentation in your training. Absolute clarity is crucial. Why because
Speaker 2: when people are under pressure, like during a real incident,
Speaker 2: that's when mistakes happen. Instructions need to be so clear
Speaker 2: a total novice could understand and follow them.
Speaker 1: That makes perfect sense. Reduce panic, reduce errors exactly.
Speaker 2: The guide also brings in the Capability Maturity Model Integration
Speaker 2: CMMI scale. It's a way to benchmark how mature your
Speaker 2: processes are from level one unpredictable, chaotic up to level
Speaker 2: five Optimize Continuously improving ESORMA helps you climb those levels,
Speaker 2: making your security BC and DR process is more reliable
Speaker 2: and effective. So it provides a path for improvement right
Speaker 2: and let's face it, disasters happen. The stats the guide
Speaker 2: quotes are pretty stark, something like ninety percent of businesses
Speaker 2: don't have a proper disaster recovery plan, and maybe even scarier,
Speaker 2: forty percent of businesses that have to shut down completely
Speaker 2: for just three days are likely to go bust within
Speaker 2: three years.
Speaker 1: Wow, forty percent.
Speaker 2: That's sobering, it really is. It highlights why BC and
Speaker 2: DR are an optional extras.
Speaker 1: So what do the actual processes the life cycles for
Speaker 1: BC and DR look like.
Speaker 2: The guide lays them out. The Business Continuity Management life
Speaker 2: cycle BCML involves things like scope and plan initiation, what
Speaker 2: we're protecting the BIA, understanding impact and timing, plan development,
Speaker 2: writting the actual plans, validation and monitoring, testing and updating
Speaker 2: and embedding it making it part of the culture. Similarly,
Speaker 2: the Disaster Recovery Plan life sie DRPL covers defining requirements,
Speaker 2: documenting the plan and training people, testing it regularly, knowing
Speaker 2: how to activate it, and then maintaining and optimizing it
Speaker 2: over time.
Speaker 1: So it's not just right and forget. It's a living process.
Speaker 2: Absolutely. It's all about proactive steps, constant revision based on
Speaker 2: tests and changes, building that muscle memory. It gives you
Speaker 2: a fighting chance to survive, minimizes downtime, and ultimately builds
Speaker 2: that crucial resilience.
Speaker 1: Okay, we've hardened the systems built resilience, but we can't
Speaker 1: just set it and forget it. That must be where
Speaker 1: Doomain six monitor comes in, keeping a constant eye on things.
Speaker 2: You got it. Monitoring is absolutely mission critical. It's how
Speaker 2: you assure those core security principles confidentiality, integrity and availability.
Speaker 2: And it spans everything operations, compliance, governance.
Speaker 1: What's the main challenge with monitoring?
Speaker 2: The biggest challenge The threat landscape never stands still. It
Speaker 2: changes daily, even hourly, and a security control that stops
Speaker 2: working may be due to it system update or a
Speaker 2: contiguration error. Well, that instantly becomes an unmitigated risk, even
Speaker 2: if you think it's still in place because it's written
Speaker 2: down somewhere.
Speaker 1: That reminds me of that example you mentioned earlier, the
Speaker 1: CEO and director sharing credentials, a control on paper but
Speaker 1: failing in reality. How is that caught?
Speaker 2: Exactly that case, the company had a policy, an administrative
Speaker 2: control for segregation of duties, but it wasn't being followed.
Speaker 2: Effective monitoring, specifically regular auditing in this case brought it
Speaker 2: to light. It wasn't sophisticated hacking, it was just well
Speaker 2: laziness and a poor security culture undermining a written control.
Speaker 1: So monitoring reveals the gap between policy and practice.
Speaker 2: Precisely, it's critical for verifying that controls are actually effective
Speaker 2: in the real world. Any SOORMA borrowing from NIST standards
Speaker 2: like SB eight hundred and point thirty seven simplifies the
Speaker 2: monitoring approach into something called SPAR. SPAR stands for strategy,
Speaker 2: What are we monitoring and why? The program? How are
Speaker 2: we doing it? Analysis? What are the results telling us?
Speaker 2: And response? What do we do about it?
Speaker 1: Our strategy? Program analysis? Response? A neat framework. What kind
Speaker 1: of tools help with the program part?
Speaker 2: There's a whole range of tools. A big one is
Speaker 2: sign security information and Event management systems. These collect logs
Speaker 2: from all of your network and use clever analysis to
Speaker 2: spot suspicious activity. You've also got continuous audit modules often
Speaker 2: called c AT's Computer assisted audit techniques embedded in systems.
Speaker 2: Even manual audit logs, though they can be tedious to review,
Speaker 2: are vital for forensic investigations. Then there's heartbeat monitor and
Speaker 2: simple checks to see if systems are up and running,
Speaker 2: Penetration testing, ethical hacking basically hiring experts to proactively find
Speaker 2: your weaknesses before the bad guys do, and control objective evaluation,
Speaker 2: which is more of a manual process reviewing if a
Speaker 2: control is designed and operating effectively to meet its objective.
Speaker 1: So a mix of automated and manual checks.
Speaker 2: Yeah, you need both. It's all about getting that continuous
Speaker 2: assurance that your defenses are working as intended.
Speaker 1: That makes sense. So from monitoring we shift into the
Speaker 1: data today grind the rhythm of security. That sounds like
Speaker 1: Domain seven operations. What does that look like? Especially for
Speaker 1: businesses maybe without a huge dedicated security operation center?
Speaker 2: Sooc right, security operations is really about that constant cycle
Speaker 2: monitoring for events and then responding appropriately when something happens.
Speaker 2: And you're right. Big companies often have these dedicated twenty
Speaker 2: four to seven scs, but even smaller businesses need someone
Speaker 2: responsible for managing the operational basics. The guide shares another
Speaker 2: powerful story here about a bank during a crisis, operations
Speaker 2: completely failed because the person who knew they needed to
Speaker 2: shut down the network, well, they didn't actually have the
Speaker 2: authority to do it in the documented procedures That hesitation.
Speaker 2: That untested operational structure costs the millions.
Speaker 1: Ouch a failure in the how. So, if you don't
Speaker 1: have an SC what's the practical alternative for managing operations?
Speaker 2: A really well defined information security policy is key. Along
Speaker 2: with those solid business continuity and disaster recovery plans we
Speaker 2: talked about in Harden. They provide the operational framework, and
Speaker 2: ZORMA breaks down managing operations into what it calls three
Speaker 2: basic elements, simple but effective. First, the who. This covers
Speaker 2: all the people aspects, staffing, defining roles, clearly hiring the
Speaker 2: right people, onboarding them properly, ongoing training, regular security meetings,
Speaker 2: retaining good staff, and even considering the psychological side. Are
Speaker 2: security measures usable and accepted? The human element again crucial absolutely? Second,
Speaker 2: the how? This is about having clear written processes. Your
Speaker 2: information security policy is central here, but also things like
Speaker 2: employee handbooks that spell out responsibilities. Everyone needs to know
Speaker 2: how things are supposed to work. And Third, the what?
Speaker 2: What exactly are we measuring and responding to? This includes
Speaker 2: potential losses across different categories, legal finds, contractual penalties, failing standards,
Speaker 2: direct financial loss, damage to reputation, or just disruption to business? Who?
Speaker 1: How? What? Simple framework, simple, but it covers the basis
Speaker 1: the ultimate goal good security operations should almost feel invisible
Speaker 1: when it's properly integrated into how the business works. When
Speaker 1: it becomes second nature, it just happens. It's about aligning
Speaker 1: security ops smoothly with the overall corporate strategy, not having
Speaker 1: it feel like a separate, bolted on function.
Speaker 2: Invisible security. I like that call okay that brings us
Speaker 2: to the final domain, the one that sends to tie
Speaker 2: everything together, Domain eight. Comply. This feels like the big
Speaker 2: umbrella covering all the rules and regulations. How does ESORMA
Speaker 2: approach compliance? You're right, Comply is really all encompassing, and
Speaker 2: it's directly tied to governance because it's ultimately senior management
Speaker 2: who decides what the organization needs to comply with. This
Speaker 2: includes mandatory laws and regulations, but also any optional standards
Speaker 2: the business chooses to adopt. The sorm of breaks compliance
Speaker 2: down into four distinct parts. Businesses need to manage. First,
Speaker 2: geographic locations. Wherever you operate or store data, you have
Speaker 2: to comply with local laws think computer misuse laws and
Speaker 2: definitely data privacy laws like GDPR and Europe CCPA in
Speaker 2: Californior and so on. The fines for getting these wrong
Speaker 2: can be huge.
Speaker 1: Yeah, those GDPR finds are no joke. What's the second part?
Speaker 2: Contractual obligations. These are the promises you make to third parties,
Speaker 2: customer suppliers, partners, agreements about how you'll handle their data
Speaker 2: requirements for audit security levels you'll maintain. You have to
Speaker 2: meet those commitments, and the guide highlights liability here. Remember
Speaker 2: that scenario if you outsource data processing and your processor
Speaker 2: then subcontracts it again without you knowing. Under rules like GDPR,
Speaker 2: you the original data controller are likely still on the
Speaker 2: hook if something goes wrong down the chain.
Speaker 1: Wow. So the responsibility follows the data even if you
Speaker 1: lose direct control. That's important to know. What are the
Speaker 1: other two compliance areas.
Speaker 2: Kurd is organizational principles. These are rules the business sets
Speaker 2: for itself. Maybe a commitment to sustainability means choosing green
Speaker 2: data centers, which then becomes a factor in your security
Speaker 2: infrastructure choices, or ethical sourcing rules that affect your suppliers.
Speaker 2: And fourth optional standards. These are the frameworks businesses choose
Speaker 2: to follow. Things like that PCIDSS if you handle payment
Speaker 2: cards ISO twenty seven zero one for a formal information
Speaker 2: security management system, then cybersecurity framework cyber Essentials in the UK.
Speaker 2: Adopting these helps structure your security efforts, demonstrates good practice
Speaker 2: and can build trust and prestige.
Speaker 1: So mandatory laws, contracts, internal principles and optional frameworks that
Speaker 1: covers a lot.
Speaker 2: It does. And while there are complex tools out there
Speaker 2: like the UCF Unified Controls Framework or the Cloud Controls
Speaker 2: Matrix CCM to map controls across multiple standards, ESORMA takes
Speaker 2: a more practical approach. It encourages referencing the specific clauses
Speaker 2: from these laws or standards directly in your risk registers.
Speaker 2: Linking the requirement to the risk and the control the
Speaker 2: key message for getting management buy in on compliance. Don't
Speaker 2: just talk about rules, show them concrete examples of non
Speaker 2: compliance consequences. Frame it as this is what the business
Speaker 2: absolutely does not want to happen.
Speaker 1: Focus on the negative outcomes to drive positive action. Smart. Okay,
Speaker 1: we've covered a lot of ground, walk through all eight
Speaker 1: domains of ESORMA, So what does this all mean for
Speaker 1: you listening in? We've done this deep dive into ESORMA,
Speaker 1: and I think it's clear this framework offers a really
Speaker 1: straightforward and comprehensive way to think about security, and it
Speaker 1: applies everywhere in the business, not just the IT department.
Speaker 2: Yeah, the benefits really stack up. It simplifies things, It
Speaker 2: can help you get security improvements implemented faster, helps modernize processes,
Speaker 2: It delivers real benefits to your customers and clients, and
Speaker 2: maybe most importantly, it focuses on achieving those quick, often
Speaker 2: low cost wins early on, which builds momentum and confidence.
Speaker 1: Right, it really aims to shift cybersecurity away from being
Speaker 1: just a cost center something you have to do, and
Speaker 1: turn it into a strategic enabler, something that helps the
Speaker 1: business be more efficient, more resilient, and maybe even more profitable.
Speaker 2: Exactly, the landscape of cybersecurity, as we've said, is constantly shifting.
Speaker 2: What's considered secure today might genuinely be vulnerable tomorrow. It
Speaker 2: never stops, it really doesn't. And for businesses, real security
Speaker 2: is just about building higher digital walls anymore. It's more
Speaker 2: about fostering this adaptive, integrated culture, a culture where everyone
Speaker 2: from the boardroom down to the front lines understands and
Speaker 2: speaks that language of risk and resilience.
Speaker 1: A shared understanding.
Speaker 2: Precisely so, maybe a final thought for you to take
Speaker 2: away and all over as you think about your own
Speaker 2: business or organization based on what we've discussed today, what area,
Speaker 2: what process, what data set will you choose to scope first?
Speaker 2: Where might those hidden security opportunities be waiting to be
Speaker 2: uncovered so you can start building that stronger culture of
Speaker 2: resilience